# Whitepaper *Keystone Finance · Whitepaper v1.0 · May 2026 · by Kamran Choudhry* *** **ksUSD is a bidirectional-carry dollar for Solana** — a dollar whose yield comes from the carry Solana generates across its funding, staking, and lending markets, not from token emissions or off-chain Treasury bills. It captures the carry Solana's capital markets already generate — perp funding, staking yield, and lending spreads — in both directions, and pays it to whoever holds the token, with every position verifiable on-chain. Deposit USDC, hold ksUSD. The share price drifts up as Drift SOL-PERP funding, jitoSOL staking, and Kamino USDC lending accrue into one Anchor vault — **one program · one vault · one share mint.** Target: **\~11% net APY** — the conservative figure, after fees, jitoSOL's \~80% Drift collateral haircut, and slippage come out of a 15.7% model number. Every cost that drags on it is documented here, including the ones that look bad. It is a target, not a guarantee — in dead-zone funding regimes, yield compresses toward the \~4–5% USDC floor. *** ## I. The problem Dollars on Solana sit idle. The chain's native carry — funding settled every hour, credit repriced every slot, stake compounded every epoch — is real and continuous, but it is fragmented across protocols and goes uncollected by the stablecoins parked on top of it. The few that *do* pay a yield typically source it externally or from token emissions, rather than from the chain's own activity. Current stablecoin designs leave Solana-native carry fragmented across protocols. ksUSD consolidates it. ## II. The insight Solana markets generate carry as a structural byproduct of their own activity. A perp market pays a continuous funding stream from one side to the other; a staking token compounds every epoch; a lending market prices credit every slot. Collected cleanly and hedged to zero price risk, that carry is a dollar-denominated yield that depends on neither emissions nor a directional bet. ksUSD is the apparatus for collecting it. ## III. Mechanism — the three-regime engine ksUSD operates as a **deterministic, rules-based state machine.** It allocates collateral across three predefined carry regimes based on observed funding and lending conditions — no discretion, no manually-timed trades, no market predictions. A single funding-rate signal drives the state, gross SOL exposure stays ≈ 0 in every state, and transitions gate on a **12-hour dwell** and a confirmation buffer to prevent whipsaw. ``` USDC deposit │ ▼ Keystone Finance │ ▼ Regime engine (funding-rate state machine) ┌────────────────┼────────────────┐ ▼ ▼ ▼ NORMAL PARKED REVERSE f ≥ +2% −12% < f < +2% f ≤ −12% short SOL-PERP USDC lending long SOL-PERP + jitoSOL (carry < cost) + Kamino borrow └────────────────┼────────────────┘ ▼ Carry accrual (funding + staking + lending) │ ▼ ksUSD NAV ↑ (share price) ``` | Regime | Trigger (*f*) | Collateral | Perp leg | Carry sources | | ----------- | ------------- | ---------------------------------------------- | ----------------------- | ----------------------------------------------------- | | **NORMAL** | ≥ +2% | *N* jitoSOL on Drift | Short *N* SOL-PERP @ 1× | jitoSOL staking + funding received | | **REVERSE** | ≤ −12% | USDC on Kamino → borrow *N · L* jitoSOL, sell | Long *N · L* SOL-PERP | USDC lending + funding received − jitoSOL borrow cost | | **PARKED** | otherwise | All capital in USDC lending (Kamino, Marginfi) | — | USDC lending only | * *N* — SOL-equivalent notional deployed · *L* = 0.45 — Kamino jitoSOL borrow LTV, so *N · L* is the leveraged amount in **REVERSE** * Mode switches incur a one-time ≈ 20–40 bps cost (swap + perp open/close) **Triggers are cost-anchored, not tuned.** The **+2%** NORMAL threshold is set to clear Drift's round-trip perp fee (\~10 bps) and the amortized mode-switch cost before the basis pays. The **−12%** REVERSE threshold must clear all of that *plus the reverse leg itself* — the jitoSOL borrow rate (the lender's foregone \~5.8% staking yield plus Kamino's spread), scaled by leverage *L* = 0.45, roughly 2–3% of APR drag. That extra cost is why the negative threshold sits so much deeper than the positive one. Designs that ignore this cost operate efficiently in only one funding regime. **The dead zone is a feature.** When funding sits between −12% and +2%, the basis trade does not clear its own costs, so ksUSD does not run it — it parks in USDC lending and earns the floor. A protocol that forces the trade in every regime is choosing to lose money in some of them. *Refusing to trade is a position.* ## IV. Asset design — the ksUSD share **ksUSD is:** * a **non-rebasing share token** — your balance is constant; the share *price* rises as carry accrues * **redeemable against vault NAV** — instant from the liquidity buffer, or queued for larger size * **backed by the carry it earns** from Solana market structure, every position verifiable on-chain **ksUSD is not:** * a rebasing or $1-pegged stablecoin * a fixed- or guaranteed-yield product * a Treasury-bill or RWA wrapper * an emission-subsidized yield token * a fiat-backed bank deposit * a directional bet on SOL The architecture is small on purpose — one program and vault, a rule set you can read in an afternoon. Every dollar of attack surface is a dollar you have to defend; every discretionary lever is a place a human can be wrong or compromised. Complexity belongs in the market structure, not the protocol's surface area. ### Yield sources & fees Fees hit net-new gains above the high-water mark only — capital pays no rent, and exits pay no toll. | Source | Active when | Contribution | | --------------- | ------------------------- | ------------ | | Drift funding | Normal & reverse modes | 5–15% APR | | jitoSOL staking | Normal basis collateral | \~5.8% APR | | USDC lending | Buffer + reserve + parked | \~4–5% APR | | Fee | Rate | Notes | | ------------ | ----------------- | ---------------------- | | Management | **0%** | Capital pays no rent. | | Performance | **20% above HWM** | Net-new gains only. | | Reserve skim | **5% of perf** | On-chain reserve fund. | | Withdrawal | **0%** | Instant or queued. | ## V. Why Solana ksUSD is mechanically Solana-only — not a multichain product wearing a Solana skin — because the design is structurally difficult to reproduce elsewhere: * **Integrated capital markets in one composability domain.** A deep perp market (Drift), a liquid staking token accepted as collateral (jitoSOL), and a lending market against the same assets (Kamino) — all atomically CPI-able from one on-chain program. The hedge opens, the collateral posts, and the borrow settles in a single composable domain. * **Real funding-rate perps.** Drift settles funding on-venue, on-chain — a genuine two-sided funding stream you *receive*, not a pool borrow-fee you *pay*. * **Borrowable LST liquidity.** jitoSOL is both accepted as collateral and borrowable on Kamino — the precondition for the reverse leg. * **Low-cost rebalancing.** Per-transaction fees are fractions of a cent, so frequent, disciplined hedging is economic rather than prohibitive. * **Composability speed.** Atomic on-chain settlement means the whole position can be reasoned about and unwound in one place. **Why Ethereum / L2s are structurally weaker here:** gas makes frequent rebalancing uneconomic; the deepest perp venues are off-chain-matched or live on separate domains, so they aren't atomically composable from a single contract; and LST collateral, perp funding, and lending are not co-located in one atomic composability domain. The edge is the co-location — and it is Solana-specific. ## Simulated performance — V2 daily backtest (Feb 2022 – Apr 2026, 51 months) | Variant | Gross APY | Net APY | Modeled max DD | | ------------------------------------------ | --------- | ---------- | -------------------------------- | | V2 standard-only (V1 product scope) | 19.82% | **15.57%** | −0.57% | | V2 bidirectional | 20.04% | **15.73%** | −0.96% | | Public conservative claim (after haircuts) | — | **\~11%** | — | | sUSDe benchmark | 6.7% | 5.4% | bleeds in low-funding | | USDC lending benchmark | — | \~4% | flat floor (capital alternative) | The model nets the 20% performance fee. The **\~11% public claim** further deducts jitoSOL's \~80% Drift collateral weight and execution friction not in the model. USDC lending is the relevant comparison: it is the actual alternative for the same capital, and ksUSD's parked floor is roughly that rate. Reverse basis adds only \~16 bps in backtest — it fires on just 2–4% of days, so its value is regime coverage, not headline alpha. The sUSDe benchmark is an external, directional figure (public dashboards, same era), not a like-for-like backtest. **Methodology:** * Funding: Drift's public S3 archive for 793 of 1550 days (Nov 2022 – Jan 2025, on-venue); Binance SOL-USDT × empirical 2.37×/0.10× ratio elsewhere (calibrated on 22 overlap months) * Mode classification: 7-day rolling mean (avoids whipsaw) * Costs: per-side perp fee 5 bps + 10 bps slippage; tiered 20–40 bps mode-switch cost * Modeled max DD is funding-only and excludes perp-leg price impact — realistic worst month under stressed slippage is −2% to −5% Full ladder + bidirectional comparison: [historical-simulation.md](/reference/historical-simulation.md). ## Worked examples **Positive funding (NORMAL).** Funding is +2% APR or higher: 1. User deposits USDC; the vault mints ksUSD at the current share price. 2. Vault swaps USDC → jitoSOL and posts it as Drift collateral. 3. Vault opens a SOL-PERP **short** at 1× the jitoSOL notional — gross SOL exposure ≈ 0. 4. Positive funding accrues to the short, hourly. 5. jitoSOL staking yield accrues to the collateral, every epoch. 6. ksUSD NAV — and the share price — rises. Holder balance is unchanged. **Negative funding (REVERSE).** Funding is −12% APR or deeper: 1. Vault posts USDC on Kamino, borrows jitoSOL against it (LTV 0.45), and sells the jitoSOL. 2. Vault opens a SOL-PERP **long** on the leveraged notional — again gross SOL exposure ≈ 0. 3. With funding negative, the long *receives* funding. 4. Net carry = funding received + USDC lending − jitoSOL borrow cost. 5. ksUSD NAV rises whenever that net clears costs; otherwise the engine sits in PARKED. **Dead zone (PARKED).** Between −12% and +2%, all capital sits in USDC lending at \~4–5% APR — the floor — until funding clears its costs again. ## Withdrawals & redemption Redemption is defined precisely, because that is the first thing a serious allocator checks. * **NAV accounting.** Share price = vault NAV ÷ shares outstanding. NAV is marked from on-chain balances plus oracle-priced collateral; the keeper-attested position legs are bounded by a per-hour change cap and an oracle-derived sanity band. * **Instant path.** A liquidity buffer (default **10% of NAV**) absorbs the typical redemption in a single transaction at the live share price. * **Queued path.** Larger redemptions burn shares immediately at the locked share price; a permissionless crank then unwinds the position, pays out USDC, closes the request PDA, and refunds rent. * **Stressed-market slippage.** Queued payouts settle against realized unwind proceeds — in stressed markets, perp-leg price impact and swap slippage can reduce the realized amount versus the marked NAV. This is disclosed, not hidden. * **Ultimate backstop.** Wind-down (below) converts the vault to a pro-rata USDC claim at the locked share price, independent of the team. ## Risk This section is the full list of ways ksUSD can lose money, and what bounds each one. Nothing is left out because it looks bad. | Risk | Mitigation | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Smart-contract | Pre-mainnet audit (OtterSec / Sec3 / Neodyme) scheduled. Devnet only until audit complete. Do not deploy significant capital pre-audit. | | Perp-venue dependency | Drift is the only perp venue. A Drift exploit, outage, or socialized-loss event hits ksUSD directly. No current Solana alternative supports the same design — that is the source of the edge and the source of the risk. Single-venue exposure is the inherent tradeoff, not an oversight. | | Counterparty | Drift, Kamino, Marginfi, Jupiter, Jito. Position-mode design bounds exposure — no single counterparty holds all NAV at once. Reserve fund absorbs first-loss within its size. | | Oracle | Pyth SOL/USD reads gated by 5-min staleness and 2% confidence checks. Outage past those bounds can still cause loss. | | Funding compression | Parked regime earns only \~4–5% USDC APR — still positive, below headline target. The \~11% net APY is not guaranteed during dead-zone regimes. | | Liquidity withdrawal | Buffer + queued redemption absorb normal flow; an extended liquidity drought lengthens the queue and widens unwind slippage. | | Redemption queue | Queued redemptions settle against realized unwind proceeds, not marked NAV — stressed markets can reduce the payout. | | jitoSOL depeg | NAV values jitoSOL at the stake-pool `jitoSOL/SOL` rate — depeg hits NAV only via realized sales, not mark-to-market. The `settle` depeg guard auto-pauses past `lst_depeg_bps` (default 5%), arming permissionless `emergency_close`. 5% reserve skim absorbs realistic depeg losses (\~50–150 bps). Slashing + Jito-program risk are structural and cannot be hedged. | | Borrow-rate spike | A jitoSOL borrow-rate spike compresses or inverts REVERSE economics; the engine falls back to PARKED rather than running a negative-carry leg. | | Liquidation | Drift leverage and Kamino LTV carry liquidation risk in extreme rapid moves. Continuous health monitoring, auto-deleverage, and the drawdown guard cap but do not eliminate the tail. | | Regime-transition | Mode switches cost 20–40 bps and can mistime fast funding flips; the 12-hour dwell + confirmation buffer trade a little latency for far less whipsaw. | | Keeper outage | Buffer withdrawals stay open; mode rotation and queue processing halt until cranking resumes. Any wallet can step in as keeper. | ## Failure modes How the system behaves when the environment turns against it — engineered fallbacks, not hope: * **Extended funding compression** → engine sits in **PARKED**, earning the \~4–5% USDC floor until carry clears costs. No forced trade. * **Perp-venue instability** → auto-pause on oracle divergence; permissionless `emergency_close` unwinds the position; buffer redemptions stay open. * **Liquidity fragmentation** → instant buffer for normal flow, queued crank for the rest; payouts track realized proceeds. * **Collateral impairment (jitoSOL)** → depeg guard auto-pauses past `lst_depeg_bps`; reserve skim absorbs realistic losses; realized-only NAV impact. * **Sustained negative carry** → REVERSE while it clears costs, else PARKED; never a negative-carry leg held for its own sake. * **Terminal** → graceful **wind-down**: positions unwind in order and the vault converts to a pro-rata USDC claim at the locked share price. A holder's exit does not depend on the team being present or solvent — the most important promise a dollar can make is that you can always get out, including on the protocol's worst day. ## How ksUSD compares | | Collateral | Yield source | Regime coverage | Transparency | Venue dependencies | | -------------- | ----------------- | -------------------------------------- | ---------------------------- | ----------------------------------------- | --------------------------------- | | **ksUSD** | jitoSOL / USDC | Perp funding + staking + lending carry | Bidirectional + parked floor | Fully on-chain, every position verifiable | Drift, Kamino, Jito — Solana-only | | Ethena (sUSDe) | ETH/BTC + stables | Delta-hedged perp funding + staking | Long-basis only | Off-chain CEX positions, attested | Multiple CEXs + custodians | | MakerDAO (DAI) | Crypto + RWA | Stability fees + RWA / savings rate | n/a (not a carry product) | On-chain + off-chain RWA | RWA counterparties | | Sky (USDS) | Crypto + RWA | Sky savings rate (RWA / T-bills) | n/a (not a carry product) | On-chain + off-chain RWA | RWA counterparties, multichain | | Perena (USD\*) | Stablecoin basket | Swap fees + underlying stable yields | n/a (not a carry product) | On-chain | Solana AMM/DEX | ## VI. Long-term vision Ethena proved the demand for a yield-bearing dollar and exposed the limit of a one-directional design: through 2025, sUSDe rode positive funding to headline yields near 15%, then — as funding compressed — supply fell from roughly $15B toward $5.4B and yield toward \~3.7% (approximate, per public dashboards). Long-basis carry is real but cyclical; it pays in a bull and starves in the flat. ksUSD is built for the whole cycle, because the strategy runs both ways and stands aside when neither does. The longer arc is monetary infrastructure: a dollar whose yield is sourced from, and verifiable against, the market structure of the chain it lives on. Keystone Finance is the coordination layer that makes that carry collectible; ksUSD is the asset that earns it. ksUSD is designed to function as productive collateral across the Solana ecosystem — a reserve asset other protocols can hold, lend against, and build on, not vault TVL alone. > **Stablecoins optimize for settlement. ksUSD optimizes for carry coordination.** > > **Keystone turns Solana market structure into a monetary asset.** *Simulated performance does not predict future results.* *** [app.keystonefi.xyz](https://app.keystonefi.xyz) · [docs.keystonefi.xyz](https://docs.keystonefi.xyz) · *Simulated figures only — not investment advice.* --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.keystonefi.xyz/reference/whitepaper.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.